CVE-2024-3799 Information

Description

Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server it will cause a shell command execution.

This issue affects Phoniebox in all releases through 2.7. Newer releases were not tested but they might also be vulnerable.

Reference

https://cert.pl/en/posts/2024/07/CVE-2024-3798 https://cert.pl/posts/2024/07/CVE-2024-3798 https://github.com/MiczFlor/RPi-Jukebox-RFID/issues/2342